@srouterhq/server 0.0.0-stage → 0.9.0

package/dist/providers/base.d.ts

@@ -0,0 +1,177 @@
+import type { ChatMessage, ChatCompletionResponse, ChatCompletionChunk, ChatToolDefinition, ChatToolChoice, Platform } from '@srouter/shared/types.js';
+import type { QuotaObservationContext } from '../services/provider-quota.js';
+import type { ExtendedSamplingOptions } from '../lib/sampling-params.js';
+/** A provider HTTP error carrying the upstream status and, when the provider
+ *  stated one, the parsed back-off so the router can bench the key for at least
+ *  that long. The delay may come from the Retry-After header or from the error
+ *  body — see providerHttpError. */
+export interface ProviderHttpError extends Error {
+    status?: number;
+    retryAfterMs?: number;
+    /** Explicit daily-window violation from structured upstream quota details. */
+    dailyQuotaExhausted?: boolean;
+}
+/** Parse an HTTP `Retry-After` header (delta-seconds or an HTTP-date) into a
+ *  millisecond delay, clamped to MAX_RETRY_AFTER_MS. Returns undefined when
+ *  absent or unparseable. */
+export declare function parseRetryAfterMs(value: string | null | undefined): number | undefined;
+/**
+ * The back-off a provider stated inside its error BODY, in milliseconds.
+ *
+ * Not every provider uses the Retry-After header. Gemini answers a 429 with
+ * `error.details[]` carrying a `google.rpc.RetryInfo` whose `retryDelay` is
+ * "17s", and several OpenAI-compatible tiers only say it in prose. Those hints
+ * were being thrown away: the body is flattened to a single message string
+ * before it reaches the router, so a provider that told us exactly when to come
+ * back got the same heuristic cooldown ladder as one that said nothing.
+ */
+export declare function parseStatedRetryMs(body: unknown): number | undefined;
+/** Build an error for a non-OK upstream response, capturing the status and any
+ *  stated back-off. Used by every provider adapter so the proxy can honor a
+ *  provider's explicit hint when it sets the cooldown.
+ *
+ *  `body` is the already-parsed error payload the caller used to build
+ *  `message`. Only a delay is read out of it and only a number is kept — the
+ *  body itself is never retained, so nothing extra reaches a log or the
+ *  attempt trace. The Retry-After header still wins when both are present: it
+ *  is the standard channel, and preferring it keeps existing behavior exactly
+ *  as it was. */
+export declare function providerHttpError(res: Response, message: string, body?: unknown): ProviderHttpError;
+export interface CompletionOptions extends ExtendedSamplingOptions {
+    model?: string;
+    temperature?: number;
+    max_tokens?: number;
+    top_p?: number;
+    stop?: string | string[];
+    tools?: ChatToolDefinition[];
+    tool_choice?: ChatToolChoice;
+    parallel_tool_calls?: boolean;
+    stream_options?: {
+        include_usage?: boolean;
+    };
+    /** Remaining context budget (context_window − estimated_input_tokens) for
+     *  this route. resolveMaxTokens clamps max_tokens to fit. */
+    contextBudget?: number;
+    /** Per-call HTTP timeout override. Not part of the OpenAI wire format (it is
+     * stripped before the request body is built); used by the probe script so
+     * NVIDIA's 15-60s serverless cold starts don't read as failures. */
+    timeoutMs?: number;
+    /** Abort signal for the gateway's OWN client (request socket closed). The
+     * proxy surfaces thread it here so a disconnect cancels the upstream fetch
+     * AND any in-progress body/stream read — tokens stop burning and the
+     * in-flight lease frees immediately instead of when the read happens to
+     * finish. Composed with the per-attempt timeout in fetchWithTimeout; never
+     * serialized into the request body. */
+    signal?: AbortSignal;
+}
+/** Per-call abort/timeout wiring for fetchWithTimeout. */
+export interface ProviderFetchOptions {
+    /** Client-disconnect signal, composed with the per-attempt timeout via
+     * AbortSignal.any. Unlike the timeout it is never disarmed at headers, so it
+     * also aborts body reads and stream iteration through undici. */
+    signal?: AbortSignal;
+    /** What the per-attempt timeout bounds:
+     *  - 'headers' (default, historical): the abort timer dies the moment
+     *    response HEADERS arrive — right for streams, whose body legitimately
+     *    outlives any fixed deadline (readSseStream's stall watchdog owns
+     *    mid-stream hangs, the client signal owns "nobody is listening").
+     *  - 'request': the deadline stays armed across the body read too, so a 200
+     *    whose body never finishes aborts at timeoutMs instead of hanging
+     *    res.json() forever. Use for non-streaming calls, which read the whole
+     *    body as one unit. */
+    timeoutBounds?: 'headers' | 'request';
+}
+/** Per-stream timeout wiring for readSseStream (#584). */
+export interface SseStreamOptions {
+    /** The chat timeout the adapter gave fetchWithTimeout for this request
+     * (options.timeoutMs override included). Becomes the first-byte grace
+     * budget, floored at the stall budget — see firstByteBudgetMs. Defaults to
+     * fetchWithTimeout's own default, providerTimeoutMs(platform, 15000). */
+    firstByteTimeoutMs?: number;
+    /** Mid-stream inactivity budget; defaults to streamStallTimeoutMs(platform)
+     * (per-platform env > global env > 90s). 0 disables the watchdog. */
+    stallTimeoutMs?: number;
+}
+export interface KeyValidationFailure {
+    valid: false;
+    /** Provider-supplied reason suitable for health logs and the local keys UI. */
+    error: string;
+}
+export type KeyValidationResult = boolean | KeyValidationFailure;
+export declare abstract class BaseProvider {
+    abstract readonly platform: Platform;
+    abstract readonly name: string;
+    /** Providers whose free tier needs no API key (e.g. Kilo's anonymous gateway).
+     * When true, the gateway stores a sentinel key row so routing still considers
+     * the platform "configured", and the provider omits the Authorization header
+     * on outgoing requests. Defaults to false; set by subclasses. */
+    keyless: boolean;
+    abstract chatCompletion(apiKey: string, messages: ChatMessage[], modelId: string, options?: CompletionOptions, quotaContext?: QuotaObservationContext): Promise<ChatCompletionResponse>;
+    abstract streamChatCompletion(apiKey: string, messages: ChatMessage[], modelId: string, options?: CompletionOptions, quotaContext?: QuotaObservationContext): AsyncGenerator<ChatCompletionChunk>;
+    abstract validateKey(apiKey: string, quotaContext?: QuotaObservationContext): Promise<KeyValidationResult>;
+    /**
+     * Turn a conventional 401/403 validation response into a diagnostic result.
+     * Providers still return a simple boolean when no useful error body exists,
+     * but preserving the upstream message here lets the health service persist
+     * and display the reason instead of reducing every failure to "invalid".
+     */
+    protected validationResult(res: Response): Promise<KeyValidationResult>;
+    protected fetchWithTimeout(url: string, init: RequestInit, timeoutMs?: number, fetchOpts?: ProviderFetchOptions): Promise<Response>;
+    protected makeId(): string;
+    /**
+     * One reader.read() bounded by the mid-stream inactivity watchdog (#553).
+     * Shared by readSseStream and adapters that parse their own wire format
+     * (google.ts) so every stream gets the same stall semantics:
+     * PROVIDER_STREAM_STALL_TIMEOUT_MS (per-platform override
+     * PROVIDER_STREAM_STALL_TIMEOUT_<PLATFORM>, #584), default 90s, 0 disables.
+     * Client-abort rejections pass through untouched — undici errors the body
+     * with the request signal's reason, so a disconnect surfaces here as the
+     * marked error from newClientAbortError, not as a stall. `timeoutMessage`
+     * lets the first-byte read report its distinct wording (#584).
+     */
+    protected readWithStallTimeout<T>(read: () => Promise<T>, inactivityTimeoutMs: number, timeoutMessage?: string): Promise<T>;
+    /**
+     * Budget for the FIRST read of a streaming body (issue #584): the platform's
+     * chat timeout is already "how slow may the first token be" — tuned per
+     * platform at registration and env-overridable via PROVIDER_TIMEOUT_<PLATFORM>
+     * — but on streams it is disarmed the moment response HEADERS arrive, and
+     * providers like NVIDIA NIM send SSE headers instantly then prefill for
+     * minutes. Floored at the stall budget so a platform with a short chat
+     * timeout never gets a STRICTER first read than the pre-#584 watchdog gave
+     * it. 0 on either side (env-disabled chat timeout, or disabled watchdog)
+     * means the first read is unbounded — the client signal still owns
+     * "nobody is listening".
+     */
+    protected firstByteBudgetMs(chatTimeoutMs: number, stallTimeoutMs: number): number;
+    /** Distinct wording for a first-byte timeout (vs a mid-stream stall) so the
+     * attempt-trace error_summary tells slow prefill apart from a dead stream. */
+    protected firstByteTimeoutMessage(budgetMs: number): string;
+    /**
+     * Shared SSE reader for OpenAI-wire streaming endpoints (#231 audit).
+     *
+     * Hardened against the upstream failure modes observed live:
+     *  - Inactivity timeout: fetchWithTimeout's abort timer dies the moment
+     *    response HEADERS arrive, so a provider that stalls mid-body used to
+     *    hang the client forever. Each read now has its own deadline. The FIRST
+     *    read gets a grace budget derived from the platform's chat timeout
+     *    (#584) — SSE headers can arrive instantly while the model prefills a
+     *    long prompt for minutes, which is slow, not stalled.
+     *  - Abrupt EOF: a stream that ends without `[DONE]` AND without any
+     *    `finish_reason` is a truncated generation, not a completion. It used
+     *    to end the generator silently (truncation logged as success); it now
+     *    throws a retryable error so the proxy can fail over or report it.
+     *    Providers that skip `[DONE]` but do send a terminal finish_reason
+     *    (several compat shims) still complete normally.
+     *
+     * Malformed data lines are skipped, matching previous behavior.
+     *
+     * The frames additionally pass through the inline `<think>` extractor
+     * (lib/think-tags.ts): DeepSeek-style models that serialize their reasoning
+     * trace INTO delta.content as a leading `<think>…</think>` block get it
+     * moved to delta.reasoning_content, so downstream surfaces never render
+     * thinking as answer text. Streams without the tag are forwarded verbatim.
+     */
+    protected readSseStream(res: Response, opts?: SseStreamOptions): AsyncGenerator<ChatCompletionChunk>;
+    private readSseFrames;
+}
+//# sourceMappingURL=base.d.ts.map

package/dist/providers/base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../src/providers/base.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,QAAQ,EACT,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAKzE;;;oCAGoC;AACpC,MAAM,WAAW,iBAAkB,SAAQ,KAAK;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8EAA8E;IAC9E,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAQD;;6BAE6B;AAC7B,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAStF;AAuDD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAgBpE;AAUD;;;;;;;;;iBASiB;AACjB,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,iBAAiB,CAMnG;AAKD,MAAM,WAAW,iBAAkB,SAAQ,uBAAuB;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACzB,KAAK,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC7B,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,cAAc,CAAC,EAAE;QACf,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,CAAC;IACF;iEAC6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;wEAEoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;2CAKuC;IACvC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,0DAA0D;AAC1D,MAAM,WAAW,oBAAoB;IACnC;;qEAEiE;IACjE,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;;;;8BAQ0B;IAC1B,aAAa,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CACvC;AAED,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B;;;6EAGyE;IACzE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;yEACqE;IACrE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,KAAK,CAAC;IACb,+EAA+E;IAC/E,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,oBAAoB,CAAC;AAEjE,8BAAsB,YAAY;IAChC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACrC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAC/B;;;qEAGiE;IACjE,OAAO,UAAS;IAEhB,QAAQ,CAAC,cAAc,CACrB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,WAAW,EAAE,EACvB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,iBAAiB,EAC3B,YAAY,CAAC,EAAE,uBAAuB,GACrC,OAAO,CAAC,sBAAsB,CAAC;IAElC,QAAQ,CAAC,oBAAoB,CAC3B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,WAAW,EAAE,EACvB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,iBAAiB,EAC3B,YAAY,CAAC,EAAE,uBAAuB,GACrC,cAAc,CAAC,mBAAmB,CAAC;IAEtC,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAE1G;;;;;OAKG;cACa,gBAAgB,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,mBAAmB,CAAC;cA+B7D,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,WAAW,EAGjB,SAAS,SAA0C,EACnD,SAAS,CAAC,EAAE,oBAAoB,GAC/B,OAAO,CAAC,QAAQ,CAAC;IA4CpB,SAAS,CAAC,MAAM,IAAI,MAAM;IAI1B;;;;;;;;;;OAUG;cACa,oBAAoB,CAAC,CAAC,EACpC,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACtB,mBAAmB,EAAE,MAAM,EAC3B,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,CAAC,CAAC;IAcb;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,iBAAiB,CAAC,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM;IAKlF;kFAC8E;IAC9E,SAAS,CAAC,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAI3D;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;cACc,aAAa,CAC5B,GAAG,EAAE,QAAQ,EACb,IAAI,CAAC,EAAE,gBAAgB,GACtB,cAAc,CAAC,mBAAmB,CAAC;YAIvB,aAAa;CA4D7B"}

package/dist/providers/base.js

@@ -0,0 +1,354 @@
+import { proxyFetch } from '../lib/proxy.js';
+import { providerTimeoutMs, streamStallTimeoutMs } from '../lib/provider-timeout.js';
+import { extractThinkTagsFromStream } from '../lib/think-tags.js';
+/** Upper bound on a provider-supplied back-off. A malformed or hostile
+ *  `Retry-After` (e.g. 99999999999) would otherwise bench a key effectively
+ *  forever, since the value feeds the cooldown expiry directly. A day is longer
+ *  than any real free-tier reset window, so clamping cannot mask a genuine hint. */
+const MAX_RETRY_AFTER_MS = 24 * 60 * 60 * 1000;
+/** Parse an HTTP `Retry-After` header (delta-seconds or an HTTP-date) into a
+ *  millisecond delay, clamped to MAX_RETRY_AFTER_MS. Returns undefined when
+ *  absent or unparseable. */
+export function parseRetryAfterMs(value) {
+    if (!value)
+        return undefined;
+    const trimmed = value.trim();
+    if (/^\d+$/.test(trimmed))
+        return Math.min(Number(trimmed) * 1000, MAX_RETRY_AFTER_MS);
+    const when = Date.parse(trimmed);
+    if (!Number.isNaN(when)) {
+        return Math.min(Math.max(0, when - Date.now()), MAX_RETRY_AFTER_MS);
+    }
+    return undefined;
+}
+/** A protobuf Duration, as google.rpc.RetryInfo spells its `retryDelay`:
+ *  digits, an optional fraction, then a literal `s` ("17s", "1.5s", "0.25s"). */
+const PROTOBUF_DURATION = /^(\d+(?:\.\d+)?)s$/;
+/** "Please try again in 7.66s" / "retry after 30 seconds" / "try again in 2m".
+ *  Anchored on an explicit retry phrase so an unrelated number in an error
+ *  message can never be mistaken for a back-off. */
+const PROSE_RETRY = /(?:try again|retry)\s+(?:in|after)\s+(\d+(?:\.\d+)?)\s*(ms|s|sec|secs|second|seconds|m|min|mins|minute|minutes|h|hour|hours)\b/i;
+const UNIT_MS = {
+    ms: 1,
+    s: 1000, sec: 1000, secs: 1000, second: 1000, seconds: 1000,
+    m: 60_000, min: 60_000, mins: 60_000, minute: 60_000, minutes: 60_000,
+    h: 3_600_000, hour: 3_600_000, hours: 3_600_000,
+};
+function clampRetryMs(ms) {
+    if (!Number.isFinite(ms) || ms < 0)
+        return undefined;
+    return Math.min(ms, MAX_RETRY_AFTER_MS);
+}
+/** Depth-first search for the first `retryDelay`/`retry_after`-shaped field. The
+ *  shape varies by provider and by endpoint within a provider, so walking is
+ *  more durable than a list of exact paths — and cheaper to maintain than one
+ *  parser per adapter. Depth-capped so a pathological body cannot spin. */
+function findStatedDelayMs(node, depth = 0) {
+    if (depth > 6 || node === null || typeof node !== 'object')
+        return undefined;
+    if (Array.isArray(node)) {
+        for (const item of node) {
+            const found = findStatedDelayMs(item, depth + 1);
+            if (found !== undefined)
+                return found;
+        }
+        return undefined;
+    }
+    for (const [key, value] of Object.entries(node)) {
+        const normalized = key.toLowerCase().replace(/[_-]/g, '');
+        if (normalized === 'retrydelay' || normalized === 'retryafter' || normalized === 'retryafterseconds') {
+            // google.rpc.RetryInfo states "17s"; other providers state bare seconds.
+            if (typeof value === 'string') {
+                const duration = PROTOBUF_DURATION.exec(value.trim());
+                if (duration)
+                    return clampRetryMs(Number(duration[1]) * 1000);
+                if (/^\d+(\.\d+)?$/.test(value.trim()))
+                    return clampRetryMs(Number(value) * 1000);
+            }
+            if (typeof value === 'number')
+                return clampRetryMs(value * 1000);
+        }
+        const found = findStatedDelayMs(value, depth + 1);
+        if (found !== undefined)
+            return found;
+    }
+    return undefined;
+}
+/**
+ * The back-off a provider stated inside its error BODY, in milliseconds.
+ *
+ * Not every provider uses the Retry-After header. Gemini answers a 429 with
+ * `error.details[]` carrying a `google.rpc.RetryInfo` whose `retryDelay` is
+ * "17s", and several OpenAI-compatible tiers only say it in prose. Those hints
+ * were being thrown away: the body is flattened to a single message string
+ * before it reaches the router, so a provider that told us exactly when to come
+ * back got the same heuristic cooldown ladder as one that said nothing.
+ */
+export function parseStatedRetryMs(body) {
+    if (body == null)
+        return undefined;
+    if (typeof body !== 'string') {
+        const structured = findStatedDelayMs(body);
+        if (structured !== undefined)
+            return structured;
+    }
+    // Prose last: a stated field is a promise, a sentence is an observation.
+    const text = typeof body === 'string' ? body : safeStringify(body);
+    const prose = text ? PROSE_RETRY.exec(text) : null;
+    if (prose) {
+        const unit = UNIT_MS[prose[2].toLowerCase()];
+        if (unit)
+            return clampRetryMs(Number(prose[1]) * unit);
+    }
+    return undefined;
+}
+function safeStringify(value) {
+    try {
+        return JSON.stringify(value) ?? '';
+    }
+    catch {
+        return ''; // Circular or otherwise unserialisable — no prose to read.
+    }
+}
+/** Build an error for a non-OK upstream response, capturing the status and any
+ *  stated back-off. Used by every provider adapter so the proxy can honor a
+ *  provider's explicit hint when it sets the cooldown.
+ *
+ *  `body` is the already-parsed error payload the caller used to build
+ *  `message`. Only a delay is read out of it and only a number is kept — the
+ *  body itself is never retained, so nothing extra reaches a log or the
+ *  attempt trace. The Retry-After header still wins when both are present: it
+ *  is the standard channel, and preferring it keeps existing behavior exactly
+ *  as it was. */
+export function providerHttpError(res, message, body) {
+    const err = new Error(message);
+    err.status = res.status;
+    const retryAfterMs = parseRetryAfterMs(res.headers?.get('retry-after')) ?? parseStatedRetryMs(body);
+    if (retryAfterMs !== undefined)
+        err.retryAfterMs = retryAfterMs;
+    return err;
+}
+export class BaseProvider {
+    /** Providers whose free tier needs no API key (e.g. Kilo's anonymous gateway).
+     * When true, the gateway stores a sentinel key row so routing still considers
+     * the platform "configured", and the provider omits the Authorization header
+     * on outgoing requests. Defaults to false; set by subclasses. */
+    keyless = false;
+    /**
+     * Turn a conventional 401/403 validation response into a diagnostic result.
+     * Providers still return a simple boolean when no useful error body exists,
+     * but preserving the upstream message here lets the health service persist
+     * and display the reason instead of reducing every failure to "invalid".
+     */
+    async validationResult(res) {
+        if (res.status !== 401 && res.status !== 403)
+            return true;
+        // A Cloudflare bot challenge ("Just a moment...") is a 403 about the
+        // caller's IP and User-Agent, not about the key. Surface it as
+        // inconclusive so health never auto-disables a good key behind it (#1298).
+        if (res.headers?.get('cf-mitigated') === 'challenge') {
+            throw providerHttpError(res, `${this.name} key validation blocked by a Cloudflare challenge (HTTP ${res.status}); the key was not checked`);
+        }
+        let body = null;
+        try {
+            if (typeof res.json === 'function')
+                body = await res.json();
+        }
+        catch {
+            // A status and provider name are still more useful than no reason.
+        }
+        const detail = [
+            body?.error?.message,
+            body?.errors?.[0]?.message,
+            body?.message,
+            body?.detail,
+            body?.title,
+            res.statusText,
+        ].find((value) => typeof value === 'string' && value.trim().length > 0);
+        return {
+            valid: false,
+            error: `${this.name} key validation failed (HTTP ${res.status})${detail ? `: ${detail}` : ''}`,
+        };
+    }
+    async fetchWithTimeout(url, init, 
+    // Adapters that don't pass a timeout inherit the platform's env override
+    // (PROVIDER_TIMEOUT_<PLATFORM>, issue #547) over the historical 15s.
+    timeoutMs = providerTimeoutMs(this.platform, 15000), fetchOpts) {
+        const signals = [];
+        if (fetchOpts?.signal)
+            signals.push(fetchOpts.signal);
+        // timeoutMs <= 0 means "no timeout" (PROVIDER_TIMEOUT_<PLATFORM>=0).
+        // setTimeout(abort, 0) would abort every request on the next macrotask.
+        let headerTimer;
+        if (timeoutMs > 0) {
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), timeoutMs);
+            signals.push(controller.signal);
+            if (fetchOpts?.timeoutBounds === 'request') {
+                // Whole-request deadline: stays armed across the body read, so a 200
+                // whose body never finishes aborts res.json() at timeoutMs instead of
+                // hanging forever. Never cleared — firing after the response is fully
+                // consumed is a no-op — and unref'd so a spent request's leftover
+                // deadline can't hold the process open.
+                timer.unref?.();
+            }
+            else {
+                // Historical header-only deadline: disarmed the moment response
+                // HEADERS arrive (see finally). Streams need this — an SSE body
+                // legitimately outlives any fixed deadline, and mid-stream hangs are
+                // owned by the stall watchdog (readSseStream) + the client signal.
+                headerTimer = timer;
+            }
+        }
+        // Compose the per-attempt timeout with the client-disconnect signal.
+        // Unlike the timeout, the client signal is never disarmed: undici ties it
+        // to the whole request, so a disconnect also aborts body reads and stream
+        // iteration, rejecting them with the marked reason from newClientAbortError.
+        const signal = signals.length === 0
+            ? init.signal ?? undefined
+            : signals.length === 1 ? signals[0] : AbortSignal.any(signals);
+        try {
+            // requestType='chat' + timeoutMs makes the AbortError message read
+            // `<platform>, chat, 15s` for triage from the requests.error column.
+            return await proxyFetch(url, signal ? { ...init, signal } : init, this.platform, 'chat', timeoutMs);
+        }
+        finally {
+            if (headerTimer !== undefined)
+                clearTimeout(headerTimer);
+        }
+    }
+    makeId() {
+        return `chatcmpl-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+    }
+    /**
+     * One reader.read() bounded by the mid-stream inactivity watchdog (#553).
+     * Shared by readSseStream and adapters that parse their own wire format
+     * (google.ts) so every stream gets the same stall semantics:
+     * PROVIDER_STREAM_STALL_TIMEOUT_MS (per-platform override
+     * PROVIDER_STREAM_STALL_TIMEOUT_<PLATFORM>, #584), default 90s, 0 disables.
+     * Client-abort rejections pass through untouched — undici errors the body
+     * with the request signal's reason, so a disconnect surfaces here as the
+     * marked error from newClientAbortError, not as a stall. `timeoutMessage`
+     * lets the first-byte read report its distinct wording (#584).
+     */
+    async readWithStallTimeout(read, inactivityTimeoutMs, timeoutMessage) {
+        if (inactivityTimeoutMs <= 0)
+            return read();
+        let timer;
+        return Promise.race([
+            read(),
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error(timeoutMessage ?? `${this.name} stream stalled: no data for ${inactivityTimeoutMs}ms (timeout)`)), inactivityTimeoutMs);
+            }),
+        ]).finally(() => clearTimeout(timer));
+    }
+    /**
+     * Budget for the FIRST read of a streaming body (issue #584): the platform's
+     * chat timeout is already "how slow may the first token be" — tuned per
+     * platform at registration and env-overridable via PROVIDER_TIMEOUT_<PLATFORM>
+     * — but on streams it is disarmed the moment response HEADERS arrive, and
+     * providers like NVIDIA NIM send SSE headers instantly then prefill for
+     * minutes. Floored at the stall budget so a platform with a short chat
+     * timeout never gets a STRICTER first read than the pre-#584 watchdog gave
+     * it. 0 on either side (env-disabled chat timeout, or disabled watchdog)
+     * means the first read is unbounded — the client signal still owns
+     * "nobody is listening".
+     */
+    firstByteBudgetMs(chatTimeoutMs, stallTimeoutMs) {
+        if (chatTimeoutMs <= 0 || stallTimeoutMs <= 0)
+            return 0;
+        return Math.max(chatTimeoutMs, stallTimeoutMs);
+    }
+    /** Distinct wording for a first-byte timeout (vs a mid-stream stall) so the
+     * attempt-trace error_summary tells slow prefill apart from a dead stream. */
+    firstByteTimeoutMessage(budgetMs) {
+        return `${this.name} stream: no first byte within ${budgetMs}ms (first-byte timeout)`;
+    }
+    /**
+     * Shared SSE reader for OpenAI-wire streaming endpoints (#231 audit).
+     *
+     * Hardened against the upstream failure modes observed live:
+     *  - Inactivity timeout: fetchWithTimeout's abort timer dies the moment
+     *    response HEADERS arrive, so a provider that stalls mid-body used to
+     *    hang the client forever. Each read now has its own deadline. The FIRST
+     *    read gets a grace budget derived from the platform's chat timeout
+     *    (#584) — SSE headers can arrive instantly while the model prefills a
+     *    long prompt for minutes, which is slow, not stalled.
+     *  - Abrupt EOF: a stream that ends without `[DONE]` AND without any
+     *    `finish_reason` is a truncated generation, not a completion. It used
+     *    to end the generator silently (truncation logged as success); it now
+     *    throws a retryable error so the proxy can fail over or report it.
+     *    Providers that skip `[DONE]` but do send a terminal finish_reason
+     *    (several compat shims) still complete normally.
+     *
+     * Malformed data lines are skipped, matching previous behavior.
+     *
+     * The frames additionally pass through the inline `<think>` extractor
+     * (lib/think-tags.ts): DeepSeek-style models that serialize their reasoning
+     * trace INTO delta.content as a leading `<think>…</think>` block get it
+     * moved to delta.reasoning_content, so downstream surfaces never render
+     * thinking as answer text. Streams without the tag are forwarded verbatim.
+     */
+    async *readSseStream(res, opts) {
+        yield* extractThinkTagsFromStream(this.readSseFrames(res, opts));
+    }
+    async *readSseFrames(res, opts) {
+        const reader = res.body?.getReader();
+        if (!reader)
+            throw new Error('No response body');
+        // The 90s default was hardcoded and silently truncated slow streams — the
+        // gateway ended them with an error frame plus a clean [DONE] that OpenAI
+        // SDK clients swallow, so responses "just stopped" (issue #553). Operators
+        // proxying slow free tiers can raise it (or 0 to disable) via
+        // PROVIDER_STREAM_STALL_TIMEOUT_MS, or per platform via
+        // PROVIDER_STREAM_STALL_TIMEOUT_<PLATFORM> (#584).
+        const inactivityTimeoutMs = opts?.stallTimeoutMs ?? streamStallTimeoutMs(this.platform);
+        // First-byte grace (#584): adapters pass the same chat timeout they gave
+        // fetchWithTimeout; the fallback mirrors fetchWithTimeout's own default so
+        // adapters that never tuned either stay on max(15s-or-env, stall) — i.e.
+        // exactly the stall budget they had before.
+        const chatTimeoutMs = opts?.firstByteTimeoutMs ?? providerTimeoutMs(this.platform, 15000);
+        const firstByteMs = this.firstByteBudgetMs(chatTimeoutMs, inactivityTimeoutMs);
+        const decoder = new TextDecoder();
+        let buffer = '';
+        let sawFinishReason = false;
+        let awaitingFirstByte = true;
+        try {
+            while (true) {
+                const { done, value } = awaitingFirstByte
+                    ? await this.readWithStallTimeout(() => reader.read(), firstByteMs, this.firstByteTimeoutMessage(firstByteMs))
+                    : await this.readWithStallTimeout(() => reader.read(), inactivityTimeoutMs);
+                awaitingFirstByte = false;
+                if (done)
+                    break;
+                buffer += decoder.decode(value, { stream: true });
+                const lines = buffer.split('\n');
+                buffer = lines.pop() ?? '';
+                for (const line of lines) {
+                    const trimmed = line.trim();
+                    if (!trimmed || !trimmed.startsWith('data:'))
+                        continue;
+                    const data = trimmed.slice(5).replace(/^ /, '');
+                    if (data === '[DONE]')
+                        return;
+                    try {
+                        const chunk = JSON.parse(data);
+                        if (chunk.choices?.some(c => c.finish_reason != null))
+                            sawFinishReason = true;
+                        yield chunk;
+                    }
+                    catch {
+                        // Skip malformed chunks
+                    }
+                }
+            }
+        }
+        finally {
+            reader.cancel().catch(() => { });
+        }
+        if (!sawFinishReason) {
+            throw new Error(`${this.name} stream ended unexpectedly (no [DONE], no finish_reason) — connection reset or truncated upstream`);
+        }
+    }
+}
+//# sourceMappingURL=base.js.map

package/dist/providers/base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../src/providers/base.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAalE;;;oFAGoF;AACpF,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/C;;6BAE6B;AAC7B,MAAM,UAAU,iBAAiB,CAAC,KAAgC;IAChE,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACvF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;iFACiF;AACjF,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAE/C;;oDAEoD;AACpD,MAAM,WAAW,GAAG,iIAAiI,CAAC;AAEtJ,MAAM,OAAO,GAA2B;IACtC,EAAE,EAAE,CAAC;IACL,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI;IAC3D,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IACrE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS;CAChD,CAAC;AAEF,SAAS,YAAY,CAAC,EAAU;IAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACrD,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,kBAAkB,CAAC,CAAC;AAC1C,CAAC;AAED;;;2EAG2E;AAC3E,SAAS,iBAAiB,CAAC,IAAa,EAAE,KAAK,GAAG,CAAC;IACjD,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAE7E,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACjD,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;QACxC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;QAC3E,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC1D,IAAI,UAAU,KAAK,YAAY,IAAI,UAAU,KAAK,YAAY,IAAI,UAAU,KAAK,mBAAmB,EAAE,CAAC;YACrG,yEAAyE;YACzE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;gBACtD,IAAI,QAAQ;oBAAE,OAAO,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;gBAC9D,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;oBAAE,OAAO,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;YACpF,CAAC;YACD,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,YAAY,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAClD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;IACxC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAa;IAC9C,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IAEnC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,UAAU,CAAC;IAClD,CAAC;IAED,yEAAyE;IACzE,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC7C,IAAI,IAAI;YAAE,OAAO,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,2DAA2D;IACxE,CAAC;AACH,CAAC;AAED;;;;;;;;;iBASiB;AACjB,MAAM,UAAU,iBAAiB,CAAC,GAAa,EAAE,OAAe,EAAE,IAAc;IAC9E,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,CAAsB,CAAC;IACpD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IACxB,MAAM,YAAY,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACpG,IAAI,YAAY,KAAK,SAAS;QAAE,GAAG,CAAC,YAAY,GAAG,YAAY,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AAuED,MAAM,OAAgB,YAAY;IAGhC;;;qEAGiE;IACjE,OAAO,GAAG,KAAK,CAAC;IAoBhB;;;;;OAKG;IACO,KAAK,CAAC,gBAAgB,CAAC,GAAa;QAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC1D,qEAAqE;QACrE,+DAA+D;QAC/D,2EAA2E;QAC3E,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,cAAc,CAAC,KAAK,WAAW,EAAE,CAAC;YACrD,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,2DAA2D,GAAG,CAAC,MAAM,4BAA4B,CAAC,CAAC;QAC9I,CAAC;QAED,IAAI,IAAI,GAAQ,IAAI,CAAC;QACrB,IAAI,CAAC;YACH,IAAI,OAAQ,GAAW,CAAC,IAAI,KAAK,UAAU;gBAAE,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;QACrE,CAAC;QAED,MAAM,MAAM,GAAG;YACb,IAAI,EAAE,KAAK,EAAE,OAAO;YACpB,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO;YAC1B,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,KAAK;YACX,GAAG,CAAC,UAAU;SACf,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAExE,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,GAAG,IAAI,CAAC,IAAI,gCAAgC,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;SAC/F,CAAC;IACJ,CAAC;IAES,KAAK,CAAC,gBAAgB,CAC9B,GAAW,EACX,IAAiB;IACjB,yEAAyE;IACzE,qEAAqE;IACrE,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,EACnD,SAAgC;QAEhC,MAAM,OAAO,GAAkB,EAAE,CAAC;QAClC,IAAI,SAAS,EAAE,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAEtD,qEAAqE;QACrE,wEAAwE;QACxE,IAAI,WAAsD,CAAC;QAC3D,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAChC,IAAI,SAAS,EAAE,aAAa,KAAK,SAAS,EAAE,CAAC;gBAC3C,qEAAqE;gBACrE,sEAAsE;gBACtE,sEAAsE;gBACtE,kEAAkE;gBAClE,wCAAwC;gBACxC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAClB,CAAC;iBAAM,CAAC;gBACN,gEAAgE;gBAChE,gEAAgE;gBAChE,qEAAqE;gBACrE,mEAAmE;gBACnE,WAAW,GAAG,KAAK,CAAC;YACtB,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,0EAA0E;QAC1E,0EAA0E;QAC1E,6EAA6E;QAC7E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC;YACjC,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,SAAS;YAC1B,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAEjE,IAAI,CAAC;YACH,mEAAmE;YACnE,qEAAqE;YACrE,OAAO,MAAM,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACtG,CAAC;gBAAS,CAAC;YACT,IAAI,WAAW,KAAK,SAAS;gBAAE,YAAY,CAAC,WAAW,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAES,MAAM;QACd,OAAO,YAAY,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAC5E,CAAC;IAED;;;;;;;;;;OAUG;IACO,KAAK,CAAC,oBAAoB,CAClC,IAAsB,EACtB,mBAA2B,EAC3B,cAAuB;QAEvB,IAAI,mBAAmB,IAAI,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAC5C,IAAI,KAAgD,CAAC;QACrD,OAAO,OAAO,CAAC,IAAI,CAAC;YAClB,IAAI,EAAE;YACN,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC/B,KAAK,GAAG,UAAU,CAChB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,IAAI,GAAG,IAAI,CAAC,IAAI,gCAAgC,mBAAmB,cAAc,CAAC,CAAC,EACxH,mBAAmB,CACpB,CAAC;YACJ,CAAC,CAAC;SACH,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;;;;;;OAWG;IACO,iBAAiB,CAAC,aAAqB,EAAE,cAAsB;QACvE,IAAI,aAAa,IAAI,CAAC,IAAI,cAAc,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IACjD,CAAC;IAED;kFAC8E;IACpE,uBAAuB,CAAC,QAAgB;QAChD,OAAO,GAAG,IAAI,CAAC,IAAI,iCAAiC,QAAQ,yBAAyB,CAAC;IACxF,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACO,KAAK,CAAC,CAAC,aAAa,CAC5B,GAAa,EACb,IAAuB;QAEvB,KAAK,CAAC,CAAC,0BAA0B,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IACnE,CAAC;IAEO,KAAK,CAAC,CAAC,aAAa,CAC1B,GAAa,EACb,IAAuB;QAEvB,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAEjD,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,8DAA8D;QAC9D,wDAAwD;QACxD,mDAAmD;QACnD,MAAM,mBAAmB,GAAG,IAAI,EAAE,cAAc,IAAI,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxF,yEAAyE;QACzE,2EAA2E;QAC3E,yEAAyE;QACzE,4CAA4C;QAC5C,MAAM,aAAa,GAAG,IAAI,EAAE,kBAAkB,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC1F,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC;QAE/E,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,IAAI,iBAAiB,GAAG,IAAI,CAAC;QAE7B,IAAI,CAAC;YACH,OAAO,IAAI,EAAE,CAAC;gBACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,iBAAiB;oBACvC,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC;oBAC9G,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,mBAAmB,CAAC,CAAC;gBAC9E,iBAAiB,GAAG,KAAK,CAAC;gBAC1B,IAAI,IAAI;oBAAE,MAAM;gBAEhB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACjC,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;gBAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;oBAC5B,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;wBAAE,SAAS;oBACvD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBAChD,IAAI,IAAI,KAAK,QAAQ;wBAAE,OAAO;oBAC9B,IAAI,CAAC;wBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwB,CAAC;wBACtD,IAAI,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,IAAI,CAAC;4BAAE,eAAe,GAAG,IAAI,CAAC;wBAC9E,MAAM,KAAK,CAAC;oBACd,CAAC;oBAAC,MAAM,CAAC;wBACP,wBAAwB;oBAC1B,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAA+B,CAAC,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,mGAAmG,CAAC,CAAC;QACnI,CAAC;IACH,CAAC;CACF"}

package/dist/providers/blaze.d.ts

@@ -0,0 +1,11 @@
+import type { ChatCompletionChunk, ChatCompletionResponse, ChatMessage } from '@srouter/shared/types.js';
+import { type CompletionOptions, type KeyValidationResult } from './base.js';
+import type { QuotaObservationContext } from '../services/provider-quota.js';
+import { OpenAICompatProvider } from './openai-compat.js';
+export declare class BlazeProvider extends OpenAICompatProvider {
+    protected validationResult(response: Response): Promise<KeyValidationResult>;
+    constructor();
+    chatCompletion(apiKey: string, messages: ChatMessage[], modelId: string, options?: CompletionOptions, quotaContext?: QuotaObservationContext): Promise<ChatCompletionResponse>;
+    streamChatCompletion(apiKey: string, messages: ChatMessage[], modelId: string, options?: CompletionOptions, quotaContext?: QuotaObservationContext): AsyncGenerator<ChatCompletionChunk>;
+}
+//# sourceMappingURL=blaze.d.ts.map

package/dist/providers/blaze.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blaze.d.ts","sourceRoot":"","sources":["../../src/providers/blaze.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACzG,OAAO,EAAqB,KAAK,iBAAiB,EAAE,KAAK,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAQ1D,qBAAa,aAAc,SAAQ,oBAAoB;cAC5B,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,mBAAmB,CAAC;;IAc5E,cAAc,CAC3B,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,MAAM,EACxD,OAAO,CAAC,EAAE,iBAAiB,EAAE,YAAY,CAAC,EAAE,uBAAuB,GAClE,OAAO,CAAC,sBAAsB,CAAC;IAMlB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,MAAM,EACxD,OAAO,CAAC,EAAE,iBAAiB,EAAE,YAAY,CAAC,EAAE,uBAAuB,GAClE,cAAc,CAAC,mBAAmB,CAAC;CAMvC"}

package/dist/providers/blaze.js

@@ -0,0 +1,33 @@
+import { providerHttpError } from './base.js';
+import { OpenAICompatProvider } from './openai-compat.js';
+function checkModel(requested, returned) {
+    if (!returned || returned !== requested) {
+        throw Object.assign(new Error('BlazeAPI returned a different or missing model identity'), { status: 502 });
+    }
+}
+export class BlazeProvider extends OpenAICompatProvider {
+    async validationResult(response) {
+        if (!response.ok && ![401, 403].includes(response.status)) {
+            throw providerHttpError(response, 'BlazeAPI key validation is temporarily inconclusive');
+        }
+        return super.validationResult(response);
+    }
+    constructor() {
+        // Despite its name, /paid/v1 is also the documented Free-plan endpoint.
+        // Named catalog routes only: no fallback to a paid or automatic route.
+        super({ platform: 'blaze', name: 'BlazeAPI', baseUrl: 'https://api.blazeapi.org/paid/v1',
+            validateUrl: 'https://api.blazeapi.org/paid/v1/usage' });
+    }
+    async chatCompletion(apiKey, messages, modelId, options, quotaContext) {
+        const response = await super.chatCompletion(apiKey, messages, modelId, options, quotaContext);
+        checkModel(modelId, response.model);
+        return response;
+    }
+    async *streamChatCompletion(apiKey, messages, modelId, options, quotaContext) {
+        for await (const chunk of super.streamChatCompletion(apiKey, messages, modelId, options, quotaContext)) {
+            checkModel(modelId, chunk.model);
+            yield chunk;
+        }
+    }
+}
+//# sourceMappingURL=blaze.js.map

package/dist/providers/blaze.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blaze.js","sourceRoot":"","sources":["../../src/providers/blaze.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAoD,MAAM,WAAW,CAAC;AAEhG,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,SAAS,UAAU,CAAC,SAAiB,EAAE,QAAgB;IACrD,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yDAAyD,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7G,CAAC;AACH,CAAC;AAED,MAAM,OAAO,aAAc,SAAQ,oBAAoB;IAClC,KAAK,CAAC,gBAAgB,CAAC,QAAkB;QAC1D,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1D,MAAM,iBAAiB,CAAC,QAAQ,EAAE,qDAAqD,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,KAAK,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAED;QACE,wEAAwE;QACxE,uEAAuE;QACvE,KAAK,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,kCAAkC;YACtF,WAAW,EAAE,wCAAwC,EAAE,CAAC,CAAC;IAC7D,CAAC;IAEQ,KAAK,CAAC,cAAc,CAC3B,MAAc,EAAE,QAAuB,EAAE,OAAe,EACxD,OAA2B,EAAE,YAAsC;QAEnE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QAC9F,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEQ,KAAK,CAAC,CAAC,oBAAoB,CAClC,MAAc,EAAE,QAAuB,EAAE,OAAe,EACxD,OAA2B,EAAE,YAAsC;QAEnE,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,KAAK,CAAC,oBAAoB,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC;YACvG,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/providers/blockrun.d.ts

@@ -0,0 +1,14 @@
+import type { ChatCompletionChunk, ChatCompletionResponse, ChatMessage } from '@srouter/shared/types.js';
+import { type CompletionOptions, type KeyValidationResult } from './base.js';
+import { OpenAICompatProvider } from './openai-compat.js';
+import type { QuotaObservationContext } from '../services/provider-quota.js';
+export declare const BLOCKRUN_BASE_URL = "https://api.blockrun.ai/v1";
+/** API-key gateway, NOT the separate wallet/x402 endpoint. Only tested $0
+ * routes enter the signed catalog; the public roster also includes paid IDs. */
+export declare class BlockRunProvider extends OpenAICompatProvider {
+    constructor();
+    protected validationResult(response: Response): Promise<KeyValidationResult>;
+    chatCompletion(apiKey: string, messages: ChatMessage[], modelId: string, options?: CompletionOptions, quotaContext?: QuotaObservationContext): Promise<ChatCompletionResponse>;
+    streamChatCompletion(apiKey: string, messages: ChatMessage[], modelId: string, options?: CompletionOptions, quotaContext?: QuotaObservationContext): AsyncGenerator<ChatCompletionChunk>;
+}
+//# sourceMappingURL=blockrun.d.ts.map

package/dist/providers/blockrun.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blockrun.d.ts","sourceRoot":"","sources":["../../src/providers/blockrun.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACzG,OAAO,EAAqB,KAAK,iBAAiB,EAAE,KAAK,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChG,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAE7E,eAAO,MAAM,iBAAiB,+BAA+B,CAAC;AAU9D;gFACgF;AAChF,qBAAa,gBAAiB,SAAQ,oBAAoB;;cAM/B,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAO5E,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,MAAM,EACpF,OAAO,CAAC,EAAE,iBAAiB,EAAE,YAAY,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAMvF,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,MAAM,EAC3F,OAAO,CAAC,EAAE,iBAAiB,EAAE,YAAY,CAAC,EAAE,uBAAuB,GAAG,cAAc,CAAC,mBAAmB,CAAC;CAM5G"}